KeyName in the KeyInfo data element

15 views
Skip to first unread message

Joe Grein

unread,
Feb 13, 2026, 3:38:56 AM (8 days ago) Feb 13
to Keycloak User
We are migrating to KeyCloak for an existing Java project.  I see the option to set "includeKeyInfoInSignature = false" in the XMLSignatureUtil class, however the behavior is not what I expected.  Per the spec at https://www.w3.org/TR/xmldsig-core/#sec-KeyInfo the entire KeyInfo element is optional.  So if I set includeKeyInfoInSignature = false and pass null for keyName in the sign method, I am expecting that there would NOT be a keyInfo XML element generated.  Instead the util class will throw an IllegalArgumentException?  

The createKeyInfo method properly checks for a null, and the fac.newXMLSignature(si, ki); method in XMLSignatureUtil indicates that null is valid for the ki element.  So having the createKeyInfo method throw an error when the items are empty seems incorrect when trying to exclude KeyInfo in the signature?  

I would expect that  either the createKeyInfo method (XMLSignatureUtil.java line 790) would return a null if all parameters are null, OR the includeKeyInfoInSignature logic around lines 783 would be modified to only call the createKeyInfo method if keyName is not null.  

Is this a bug, or is there some specific business reason or change to the specification that  I'm missing?  

Thanks!

-Joe
Reply all
Reply to author
Forward
0 new messages